… We will take additional action as the investigation warrants. We will publish a fuller report once the investigation is complete. Written by Alexis Wales is the Chief Information Security Officer of GitHub. …
… The investigation for the February 9 incident raised a lot of important questions about why the user settings were stored in this particular database cluster and in this particular way. …
… SSH-based Git operations were not affected during either incident. Our investigation determined that both incidents shared the same underlying cause: a configuration change to a user settings caching mechanism caused a large volume of cache rewrites to occur simultaneously. …
… As recent supply chain incidents have shown, we can’t rely on the security posture of every maintainer and repository in the ecosystem to prevent the introduction of malicious code. …